← Vulnerability feed

Vulnerability record · CVE-2025-48543 · published 4 September 2025

CVE-2025-48543: Android use-after-free allows Chrome sandbox escape to system_server

Google · Android

A use-after-free in multiple Android locations lets an attacker escape the Chrome sandbox and reach the Android system_server process. Because the flaw crosses a security boundary, successful exploitation yields local privilege escalation without extra execution privileges. It matters because the sandbox is the main containment layer for untrusted web content on Android.

8.8 CVSS 3.1 High CISA KEV since 4 Sep 2025 EPSS 0.54% · top 56.6% CWE-416 · Use after free
8.8CVSS 3.1 base score
0.54%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityCVSS 8.8 with scope change and confirmed KEV exploitation, though EPSS is low and no ransomware use is documented.

What it is

A use-after-free in multiple Android locations lets an attacker escape the Chrome sandbox and reach the Android system_server process. Because the flaw crosses a security boundary, successful exploitation yields local privilege escalation without extra execution privileges. It matters because the sandbox is the main containment layer for untrusted web content on Android.

Impact

An attacker gains code execution in the system_server context, escaping the Chrome sandbox and escalating privileges on the device. This can compromise the platform's core system process and the data it mediates.

Attack surface

Reached locally (AV:L) with low privileges (PR:L) and no user interaction (UI:N); the description states no additional execution privileges are needed. The scope change (S:C) confirms the sandbox boundary is crossed into system_server.

Exploitation

CISA added it to KEV on 2025-09-04 with a 2025-09-25 remediation due, indicating known exploitation. EPSS is low (0.00531, 43.6th percentile), and no ransomware use is documented.

What to do

  • Apply the Android security bulletin 2025-09-01 patches and the ART patch referenced in the advisory.
  • Prioritize remediation per CISA BOD 22-01 given the KEV listing and 2025-09-25 due date.
  • If patching is not possible, follow vendor mitigations or discontinue use of affected builds.
  • Track device fleet patch levels to confirm the fix is deployed on all Android endpoints.

Detection

  • Monitor for crashes or abnormal behavior in system_server and Chrome renderer processes on Android devices.
  • Hunt for unexpected privilege escalation or anomalous IPC into system_server from sandboxed app processes.
  • Correlate device logs with known exploitation indicators around the KEV due date window.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Exploitation in the wild

CISA added CVE-2025-48543 to the Known Exploited Vulnerabilities catalog on 4 September 2025 as "Android Runtime Use-After-Free Vulnerability". Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 25 September 2025.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://android.googlesource.com/platform/art/+/444fc40dfb04d2ec5f74c443ed3a4dd45d3131f2 PatchProduct
https://source.android.com/security/bulletin/2025-09-01 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48543 Third Party AdvisoryUS Government Resource

Track CVE-2025-48543 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-58704Android Cellular Modem improper authorization allows adjacent privilege escalationAndroid's Cellular Modem component contains a logic error that bypasses permission checks, allowing an attacker within radio/adjacent range to escala…KEVEPSS 0.59%analysed8.4CVE-2025-48595Android Framework integer overflow enables local code executionAn integer overflow in multiple locations of the Android Framework can be turned into code execution. It allows a local attacker to escalate privileg…KEVEPSS 1.7%analysed7.8CVE-2025-48572Android Framework permissions bypass enables background activity launchMultiple locations in the Android Framework allow activities to be launched from the background because of a permissions bypass, a missing authentica…KEVEPSS 0.26%analysed7.8CVE-2024-32896Android Pixel logic error allows local privilege escalationCVE-2024-32896 is a logic error in Android (CWE-670/CWE-783) that permits a local attacker to bypass intended restrictions and escalate privileges. I…KEVEPSS 3.0%analysed7.8CVE-2024-29748Android Pixel logic error allows local privilege escalationCVE-2024-29748 is a logic error in Android code that permits bypassing a security check, leading to local escalation of privilege. It affects Google …KEVEPSS 0.67%analysed7.8CVE-2023-35674Android WindowState logic error allows background activity launch and privilege escalationA logic error in onCreate of WindowState.java in the Android Framework lets a background activity be launched, enabling local escalation of privilege…KEVEPSS 2.6%analysed7.8CVE-2023-20963Android WorkSource parcel mismatch local privilege escalationCVE-2023-20963 is a parcel mismatch in Android's WorkSource component that allows a local attacker to escalate privileges without additional executio…KEVEPSS 1.5%analysed7.8CVE-2021-39793Android Mali GPU driver out-of-bounds write in kbase_jd_user_buf_pin_pagesThe Android kernel Mali GPU driver function kbase_jd_user_buf_pin_pages in mali_kbase_mem.c contains a logic error that causes an out-of-bounds write…KEVEPSS 0.69%analysed

Source: NIST National Vulnerability Database (record CVE-2025-48543), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.